@interop/was-react 0.10.0 → 0.11.1

package/README.md

@@ -125,14 +125,14 @@ without them a concurrent multi-device edit falls back to server-wins.
 
 At login, a public collection is requested from the wallet with the distinct
 `https://w3id.org/byoe#public-collection` descriptor type (private collections
-use `https://w3id.org/byoe#collection`): the wallet provisions it plaintext with
-a public-read policy, shows a world-readable consent warning, and delegates the
-usual read/write capability (public covers only unauthenticated reads; writes
-stay capability-only). A wallet that predates the descriptor reports the request
-unsatisfiable rather than silently provisioning a private collection, so the
-feature fails closed with older wallets. Publicness is granted at consent time
-by the wallet -- the app itself can never escalate an existing private
-collection to public.
+use `https://w3id.org/byoe#private-collection`): the wallet provisions it
+plaintext with a public-read policy, shows a world-readable consent warning, and
+delegates the usual read/write capability (public covers only unauthenticated
+reads; writes stay capability-only). A wallet that predates the descriptor
+reports the request unsatisfiable rather than silently provisioning a private
+collection, so the feature fails closed with older wallets. Publicness is
+granted at consent time by the wallet -- the app itself can never escalate an
+existing private collection to public.
 
 #### Shared (wallet-owned) collections
 
@@ -173,13 +173,13 @@ the same `key` or `id` in each is rejected at store open
 (`validateSharedCollections`).
 
 At login each shared collection is requested with the distinct
-`https://w3id.org/byoe#shared-collection` descriptor type and the read-only
-action set `SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to write a
-wallet collection. As with `https://w3id.org/byoe#public-collection`, a wallet
-that predates the type reports the request unsatisfiable and the feature fails
-closed, which is the point: a share fuses two axes -- the read zcap AND an entry
-in the collection's key-epoch roster -- and a wallet that granted only the zcap
-would hand the app ciphertext it cannot decrypt, surfacing as corrupt data
+`https://w3id.org/byoe#shared-wallet-collection` descriptor type and the
+read-only action set `SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to
+write a wallet collection. As with `https://w3id.org/byoe#public-collection`, a
+wallet that predates the type reports the request unsatisfiable and the feature
+fails closed, which is the point: a share fuses two axes -- the read zcap AND an
+entry in the collection's key-epoch roster -- and a wallet that granted only the
+zcap would hand the app ciphertext it cannot decrypt, surfacing as corrupt data
 rather than as a wallet that needs updating.
 
 Decryption uses the app's **identity** key-agreement key: the X25519 twin of its
@@ -395,8 +395,8 @@ a progress line (`connecting` to `verifying`):
 2. **One popup.** A VPR carrying a `DIDAuthentication` query plus one
    `AppConnectQuery` -- the app's display name, `credentialType`, and
    `vocabBase`, a `capabilityQuery` entry per configured collection, and a
-   `https://w3id.org/byoe#shared-collection` entry per shared collection -- is
-   sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
+   `https://w3id.org/byoe#shared-wallet-collection` entry per shared collection
+   -- is sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
    response is a user cancel (`LoginCancelledError`), not an error.
 3. **The wallet matches or mints.** On a first run the wallet generates the
    32-byte seed itself, self-issues the origin-bound app-key credential, and

package/dist/auth/loginFlow.d.ts

@@ -50,8 +50,8 @@ export interface LoginConfig {
     collections: GrantRequestCollection[];
     /**
      * WAS collection ids of wallet-owned collections to request read-and-decrypt
-     * access to (the `https://w3id.org/byoe#shared-collection` grant). Read-only; never
-     * replicated.
+     * access to (the `https://w3id.org/byoe#shared-wallet-collection` grant).
+     * Read-only; never replicated.
      */
     sharedCollections?: string[];
     /**

package/dist/auth/loginRequest.d.ts

@@ -32,8 +32,9 @@
  * fails closed rather than degrading into a partial generic flow.
  *
  * A SHARED collection -- one the wallet already owns and encrypts, which the app
- * asks to read and decrypt -- uses the `https://w3id.org/byoe#shared-collection` descriptor
- * type, and the actions are read-only by construction ({@link SHARED_ACTIONS}):
+ * asks to read and decrypt -- uses the
+ * `https://w3id.org/byoe#shared-wallet-collection` descriptor type, and the
+ * actions are read-only by construction ({@link SHARED_ACTIONS}):
  * the app never requests writes on a wallet collection. Exactly like
  * `https://w3id.org/byoe#public-collection`, a wallet that predates the type resolves the
  * descriptor UNSATISFIABLE and fails closed -- which is the point here. A share
@@ -50,8 +51,8 @@ import type { SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IVPRDetails } from './walletRequestTypes.js';
 /**
  * Default read/write actions requested on each private app collection -- also
- * the `https://w3id.org/byoe#collection` class ceiling (the full WAS action
- * vocabulary).
+ * the `https://w3id.org/byoe#private-collection` class ceiling (the full WAS
+ * action vocabulary).
  */
 export declare const RW_ACTIONS: string[];
 /**
@@ -73,8 +74,9 @@ export declare const SHARED_ACTIONS: string[];
  * The action ceiling of the descriptor class a collection is requested with
  * (the App Connect spec's "Action ceilings" table): add-only for
  * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
- * vocabulary otherwise (`https://w3id.org/byoe#collection`). Shares have their
- * own fixed {@link SHARED_ACTIONS} and never consult a configured action set.
+ * vocabulary otherwise (`https://w3id.org/byoe#private-collection`). Shares
+ * have their own fixed {@link SHARED_ACTIONS} and never consult a configured
+ * action set.
  *
  * @param [visibility] {'private' | 'public'}
  * @returns {string[]}
@@ -91,8 +93,8 @@ export interface GrantRequestCollection {
     id: string;
     /**
      * Who can read the collection; selects the descriptor type
-     * (`https://w3id.org/byoe#collection` for `'private'`/unset, `https://w3id.org/byoe#public-collection`
-     * for `'public'`).
+     * (`https://w3id.org/byoe#private-collection` for `'private'`/unset,
+     * `https://w3id.org/byoe#public-collection` for `'public'`).
      */
     visibility?: 'private' | 'public';
 }
@@ -110,8 +112,8 @@ export declare function newChallenge(): string;
  * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
  * and MINUS `reason` (the App Connect consent screen supersedes per-grant
  * reasons). A `visibility: 'public'` collection uses the
- * `https://w3id.org/byoe#public-collection` descriptor type; everything else uses
- * `https://w3id.org/byoe#collection`.
+ * `https://w3id.org/byoe#public-collection` descriptor type; everything else
+ * uses `https://w3id.org/byoe#private-collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
@@ -123,8 +125,9 @@ export declare function newChallenge(): string;
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
- *   wallet-owned collections to request read-and-decrypt access to; each gets a
- *   `https://w3id.org/byoe#shared-collection` descriptor with {@link SHARED_ACTIONS}
+ *   wallet-owned collections to request read-and-decrypt access to; each gets
+ *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
+ *   {@link SHARED_ACTIONS}
  * @param [options.actions] {string[]}   the action set to request on each app
  *   collection; when omitted each collection requests exactly its class
  *   ceiling ({@link actionCeiling}). An explicit set naming an action above a

package/dist/auth/loginRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAA0B,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAEzE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAA0B,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAEzE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}

package/dist/auth/loginRequest.js

@@ -1,7 +1,7 @@
 /**
  * Default read/write actions requested on each private app collection -- also
- * the `https://w3id.org/byoe#collection` class ceiling (the full WAS action
- * vocabulary).
+ * the `https://w3id.org/byoe#private-collection` class ceiling (the full WAS
+ * action vocabulary).
  */
 export const RW_ACTIONS = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'];
 /**
@@ -23,8 +23,9 @@ export const SHARED_ACTIONS = ['GET', 'HEAD'];
  * The action ceiling of the descriptor class a collection is requested with
  * (the App Connect spec's "Action ceilings" table): add-only for
  * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
- * vocabulary otherwise (`https://w3id.org/byoe#collection`). Shares have their
- * own fixed {@link SHARED_ACTIONS} and never consult a configured action set.
+ * vocabulary otherwise (`https://w3id.org/byoe#private-collection`). Shares
+ * have their own fixed {@link SHARED_ACTIONS} and never consult a configured
+ * action set.
  *
  * @param [visibility] {'private' | 'public'}
  * @returns {string[]}
@@ -82,8 +83,8 @@ function requestedActions({ id, visibility, actions }) {
  * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
  * and MINUS `reason` (the App Connect consent screen supersedes per-grant
  * reasons). A `visibility: 'public'` collection uses the
- * `https://w3id.org/byoe#public-collection` descriptor type; everything else uses
- * `https://w3id.org/byoe#collection`.
+ * `https://w3id.org/byoe#public-collection` descriptor type; everything else
+ * uses `https://w3id.org/byoe#private-collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
@@ -95,8 +96,9 @@ function requestedActions({ id, visibility, actions }) {
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
- *   wallet-owned collections to request read-and-decrypt access to; each gets a
- *   `https://w3id.org/byoe#shared-collection` descriptor with {@link SHARED_ACTIONS}
+ *   wallet-owned collections to request read-and-decrypt access to; each gets
+ *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
+ *   {@link SHARED_ACTIONS}
  * @param [options.actions] {string[]}   the action set to request on each app
  *   collection; when omitted each collection requests exactly its class
  *   ceiling ({@link actionCeiling}). An explicit set naming an action above a
@@ -111,7 +113,7 @@ export function buildAppConnectVpr({ challenge, domain, appName, credential, col
         invocationTarget: {
             type: visibility === 'public'
                 ? 'https://w3id.org/byoe#public-collection'
-                : 'https://w3id.org/byoe#collection',
+                : 'https://w3id.org/byoe#private-collection',
             name: id
         }
     }));
@@ -120,7 +122,7 @@ export function buildAppConnectVpr({ challenge, domain, appName, credential, col
             referenceId: id,
             allowedAction: SHARED_ACTIONS,
             invocationTarget: {
-                type: 'https://w3id.org/byoe#shared-collection',
+                type: 'https://w3id.org/byoe#shared-wallet-collection',
                 name: id
             }
         });

package/dist/auth/loginRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAsDA;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC;IAC7D,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;AAC9D,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,sDAAsD;YACrE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,kCAAkC;YACxC,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,yCAAyC;gBAC/C,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAuDA;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC;IAC7D,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;AAC9D,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,sDAAsD;YACrE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,0CAA0C;YAChD,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,gDAAgD;gBACtD,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/auth/walletRequestTypes.d.ts

@@ -45,8 +45,9 @@ export type IDIDAuthenticationQuery = {
  * (`controller`) wants on which storage target (`invocationTarget`), with an
  * optional human-readable `reason` and RP-chosen `referenceId`. The
  * `invocationTarget` is either a plain URL (satisfied only under the user's own
- * Space) or a wallet-defined descriptor object (`https://w3id.org/byoe#collection`), resolved
- * by `resolveInvocationTarget`. Login requests only ever ask for
+ * Space) or a wallet-defined descriptor object
+ * (`https://w3id.org/byoe#private-collection`), resolved by
+ * `resolveInvocationTarget`. Login requests only ever ask for
  * collection-scoped capabilities.
  */
 export type ICapabilityQueryDetail = {

package/dist/auth/walletRequestTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}

package/dist/dev/provisionDevGrants.d.ts

@@ -34,7 +34,8 @@ export interface ProvisionDevGrantsResult {
     provisionerDid: string;
     /**
      * Present only when `probe` was requested: the result of PUTting the
-     * encryption descriptor with the app's delegated RW zcap.
+     * collection description (read first, written back verbatim) with the app's
+     * delegated RW zcap.
      */
     probe?: {
         authorized: boolean;
@@ -50,8 +51,11 @@ export interface ProvisionDevGrantsResult {
  * @param options.serverUrl {string}   base URL of a running was-teaching-server
  * @param options.seed {Uint8Array}   the app (relying party) master seed; the
  *   app DID the grants are delegated to is derived from it
- * @param options.collections {string[]}   the WAS collection ids to create and
- *   grant (e.g. `['action-items', 'projects']`)
+ * @param options.collections {Array<string | object>}   the WAS collections to
+ *   create and grant: a bare id string (private by default) or
+ *   `{ id, visibility }`. A private collection is declared `edv` and gets its
+ *   epoch[0] roster (sole recipient: the app's identity key-agreement key); a
+ *   public one stays plaintext
  * @param [options.spaceName] {string}   human-readable Space name (defaults to
  *   `'Dev Space'`)
  * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
@@ -63,7 +67,8 @@ export interface ProvisionDevGrantsResult {
  * @param [options.actions] {ActionInput[]}   the RW action set delegated per
  *   collection (defaults to the auth layer's `RW_ACTIONS`)
  * @param [options.probe] {boolean}   when true, probe whether the delegated RW
- *   zcap authorizes a PUT of the `{ encryption: { scheme: 'edv' } }` descriptor
+ *   zcap authorizes a PUT of the collection description (read first and written
+ *   back verbatim, so an installed epoch roster is never clobbered)
  * @param [options.log] {(message: string) => void}   progress sink (defaults to
  *   a no-op; the CLI passes `console.log`)
  * @returns {Promise<ProvisionDevGrantsResult>}
@@ -71,7 +76,10 @@ export interface ProvisionDevGrantsResult {
 export declare function provisionDevGrants({ serverUrl, seed, collections, spaceName, outFile, provisionerSeed, identityHandle, actions, probe, log }: {
     serverUrl: string;
     seed: Uint8Array;
-    collections: string[];
+    collections: Array<string | {
+        id: string;
+        visibility?: 'private' | 'public';
+    }>;
     spaceName?: string;
     outFile?: string;
     provisionerSeed?: Uint8Array;

package/dist/dev/provisionDevGrants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsGpC"}
+{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAA;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAiIpC"}

package/dist/dev/provisionDevGrants.js

@@ -6,22 +6,25 @@
  * this:
  *
  *   1. derives a throwaway "provisioner" identity (stands in for the wallet that
- *      owns the Space) and the app's own controller DID from the supplied seed;
+ *      owns the Space) and the app's own identity from the supplied seed;
  *   2. creates a Space (owned by the provisioner) and the requested collections,
- *      PLAINTEXT -- deliberately WITHOUT an encryption descriptor, mirroring what a
- *      wallet does when it provisions RP-requested collections;
+ *      mirroring what a wallet does when it provisions RP-requested collections:
+ *      a PRIVATE collection is declared `edv` and gets its epoch[0] roster
+ *      installed (`ensureFirstEpoch`) with the app's identity key-agreement key
+ *      as the sole recipient -- epoch-from-birth, no plaintext interlude; a
+ *      PUBLIC collection stays plaintext with no descriptor;
  *   3. delegates a per-collection read/write zcap to the app's controller DID;
  *   4. returns the signed grants and (optionally) writes them to a JSON file the
  *      app loads in dev-sync mode;
  *   5. optionally probes the open question: does the delegated, collection-scoped
- *      RW zcap authorize an RP-side PUT of the collection description carrying the
- *      { encryption: { scheme: 'edv' } } descriptor?
+ *      RW zcap authorize an RP-side PUT of the collection description?
  *
  * Node only (uses `fs`); consumed through the package `./dev` subpath.
  */
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { WasClient } from '@interop/was-client';
+import { ensureFirstEpoch, ownerRecipient } from '@interop/was-client/edv';
 import { CapabilityAgent } from '@interop/webkms-client';
 import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 import { deriveIdentity } from '../identity/agents.js';
@@ -63,8 +66,11 @@ async function provisionerClient({ serverUrl, seed }) {
  * @param options.serverUrl {string}   base URL of a running was-teaching-server
  * @param options.seed {Uint8Array}   the app (relying party) master seed; the
  *   app DID the grants are delegated to is derived from it
- * @param options.collections {string[]}   the WAS collection ids to create and
- *   grant (e.g. `['action-items', 'projects']`)
+ * @param options.collections {Array<string | object>}   the WAS collections to
+ *   create and grant: a bare id string (private by default) or
+ *   `{ id, visibility }`. A private collection is declared `edv` and gets its
+ *   epoch[0] roster (sole recipient: the app's identity key-agreement key); a
+ *   public one stays plaintext
  * @param [options.spaceName] {string}   human-readable Space name (defaults to
  *   `'Dev Space'`)
  * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
@@ -76,7 +82,8 @@ async function provisionerClient({ serverUrl, seed }) {
  * @param [options.actions] {ActionInput[]}   the RW action set delegated per
  *   collection (defaults to the auth layer's `RW_ACTIONS`)
  * @param [options.probe] {boolean}   when true, probe whether the delegated RW
- *   zcap authorizes a PUT of the `{ encryption: { scheme: 'edv' } }` descriptor
+ *   zcap authorizes a PUT of the collection description (read first and written
+ *   back verbatim, so an installed epoch roster is never clobbered)
  * @param [options.log] {(message: string) => void}   progress sink (defaults to
  *   a no-op; the CLI passes `console.log`)
  * @returns {Promise<ProvisionDevGrantsResult>}
@@ -85,7 +92,7 @@ export async function provisionDevGrants({ serverUrl, seed, collections, spaceNa
 // The server accepts HEAD even though storage-core's ActionInput union omits
 // it, hence the assertion.
 actions = RW_ACTIONS, probe = false, log = () => { } }) {
-    const [{ controllerDid: appDid, zcapClient: appZcapClient }, { was: provisioner, did: provisionerDid }] = await Promise.all([
+    const [{ controllerDid: appDid, zcapClient: appZcapClient, keyAgreementKey }, { was: provisioner, did: provisionerDid }] = await Promise.all([
         deriveIdentity({ seed, identityHandle }),
         provisionerClient({ serverUrl, seed: provisionerSeed })
     ]);
@@ -113,17 +120,32 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     };
     // `Promise.all` preserves input order, so `grants[i]` still corresponds to
     // `collections[i]` (the probe below relies on that for `[0]`).
-    const grants = await Promise.all(collections.map(async (id) => {
-        // Plaintext collection (no encryption descriptor) -- mirrors wallet
-        // provisioning.
-        await space.createCollection({ id, name: id });
+    const grants = await Promise.all(collections.map(async (entry) => {
+        const { id, visibility = 'private' } = typeof entry === 'string' ? { id: entry } : entry;
+        // A private collection mirrors wallet provisioning: declared `edv` at
+        // creation, epoch[0] installed with the app's identity key-agreement
+        // key as the sole recipient (the roster entry a wallet would write for
+        // an app-owned collection). A public collection stays plaintext.
+        const collection = await space.createCollection({
+            id,
+            name: id,
+            ...(visibility === 'private' && {
+                encryption: { scheme: 'edv' }
+            })
+        });
+        if (visibility === 'private') {
+            await ensureFirstEpoch({
+                collection,
+                recipients: [ownerRecipient({ keyAgreementKey })]
+            });
+        }
         const zcap = await provisioner.grant({
             to: appDid,
             actions,
             target: `${spaceUrl}/${id}`,
             capability: spaceRoot
         });
-        log(`  collection "${id}": created + delegated RW to app`);
+        log(`  collection "${id}": created (${visibility}) + delegated RW to app`);
         return zcap;
     }));
     if (outFile !== undefined) {
@@ -141,22 +163,32 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     if (!probe) {
         return result;
     }
-    // --- Encryption-descriptor probe ---------------------------------------------
+    // --- Description-write probe --------------------------------------------------
     // Using the app's OWN delegated RW zcap (not the provisioner root key),
-    // attempt to PUT the collection description with the edv descriptor.
+    // attempt to PUT the collection description. The description is read first
+    // and written back verbatim: authorization is what is probed, and a blind
+    // descriptor PUT would try to clobber the installed epoch roster (which the
+    // server refuses -- epochs are append-only -- muddying the answer).
     const appWas = new WasClient({ serverUrl, zcapClient: appZcapClient });
-    const probeCollectionId = collections[0];
+    const firstEntry = collections[0];
+    const probeCollectionId = typeof firstEntry === 'string' ? firstEntry : firstEntry.id;
     const probeCapability = grants[0];
-    log(`\nEncryption-descriptor probe on "${probeCollectionId}" (delegated RW zcap):`);
+    const probePath = collectionPath({
+        spaceId: space.id,
+        collectionId: probeCollectionId
+    });
+    log(`\nDescription-write probe on "${probeCollectionId}" (delegated RW zcap):`);
     try {
+        const current = await appWas.request({
+            capability: probeCapability,
+            path: probePath,
+            method: 'GET'
+        });
         const response = await appWas.request({
             capability: probeCapability,
-            path: collectionPath({
-                spaceId: space.id,
-                collectionId: probeCollectionId
-            }),
+            path: probePath,
             method: 'PUT',
-            json: { id: probeCollectionId, encryption: { scheme: 'edv' } }
+            json: (current.data ?? { id: probeCollectionId })
         });
         log(`  AUTHORIZED -- server responded ${response.status}`);
         result.probe = { authorized: true, status: response.status };

package/dist/dev/provisionDevGrants.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EACpD,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;QACzB,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,cAAc,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,YAAY,EAAE,iBAAiB;aAChC,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAwCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,EACrE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;QAC5B,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,SAAS,EAAE,GAClC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;QACnD,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;YAC9C,EAAE;YACF,IAAI,EAAE,EAAE;YACR,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC9B,UAAU,EAAE,EAAE,MAAM,EAAE,KAAc,EAAE;aACvC,CAAC;SACH,CAAC,CAAA;QACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,gBAAgB,CAAC;gBACrB,UAAU;gBACV,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;aAClD,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,eAAe,UAAU,yBAAyB,CAAC,CAAA;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iFAAiF;IACjF,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IAClC,MAAM,iBAAiB,GACrB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAA;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,MAAM,SAAS,GAAG,cAAc,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAA;IACF,GAAG,CACD,iCAAiC,iBAAiB,wBAAwB,CAC3E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACnC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAW;SAC5D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/identity/documentLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AAeF;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}
+{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAuBA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AAqBF;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}

package/dist/identity/documentLoader.js

@@ -16,15 +16,22 @@
  */
 import { createDidWebvhDriver } from '@interop/did-method-webvh/driver';
 import { createDefaultDidResolver, securityLoader } from '@interop/security-document-loader';
+import { contexts as byoeContexts } from 'byoe-context';
 const didResolver = createDefaultDidResolver();
 // The webvh driver is resolution-only (`{ method, get, resolveDID }`) by
 // design; did-io's DidMethodDriver type also demands the key-generation
 // surface (generate, fromKeyPair, ...), which resolution never calls.
 didResolver.use(createDidWebvhDriver());
-const baseLoader = securityLoader({
+const loader = securityLoader({
     fetchRemoteContexts: true,
     didResolver
-}).build();
+});
+// The BYOE App Connect context is registered here, not bundled in the security
+// loader, so vocabulary additions ship with a `byoe-context` bump alone.
+for (const [url, context] of byoeContexts) {
+    loader.addStatic(url, context);
+}
+const baseLoader = loader.build();
 /**
  * Builds the JSON-LD document loader handed to `@interop/vc` issuance and
  * verifier-core verification.

package/dist/identity/documentLoader.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EACL,wBAAwB,EACxB,cAAc,EACf,MAAM,mCAAmC,CAAA;AAW1C,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAA;AAC9C,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,WAAW,CAAC,GAAG,CACb,oBAAoB,EAAsD,CAC3E,CAAA;AAED,MAAM,UAAU,GAAG,cAAc,CAAC;IAChC,mBAAmB,EAAE,IAAI;IACzB,WAAW;CACZ,CAAC,CAAC,KAAK,EAAE,CAAA;AAEV;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAA4B,CAAA;AACrC,CAAC"}
+{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EACL,wBAAwB,EACxB,cAAc,EACf,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,cAAc,CAAA;AAWvD,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAA;AAC9C,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,WAAW,CAAC,GAAG,CACb,oBAAoB,EAAsD,CAC3E,CAAA;AAED,MAAM,MAAM,GAAG,cAAc,CAAC;IAC5B,mBAAmB,EAAE,IAAI;IACzB,WAAW;CACZ,CAAC,CAAA;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,YAAY,EAAE,CAAC;IAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAChC,CAAC;AACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAA4B,CAAA;AACrC,CAAC"}

package/dist/identity/seedStore.d.ts

@@ -20,9 +20,10 @@ export interface SeedStore {
      */
     loadRecord(): Promise<unknown | null>;
     /**
-     * Persists the collection-encryption descriptor cache (keyed by WAS collection
-     * id), so an offline / hot-restore session can rebuild its epoch-aware
-     * ciphers without a live description read.
+     * Persists the collection-encryption descriptor cache (descriptors keyed by
+     * WAS collection id, stamped with the controller DID they belong to), so an
+     * offline / hot-restore session can rebuild its epoch-aware ciphers without
+     * a live description read.
      */
     saveDescriptors(descriptors: unknown): Promise<void>;
     /**
@@ -53,6 +54,13 @@ export declare function createSeedStore({ dbName, idb }: {
  * acquires through: per-collection get/put over the single stored blob, already
  * scoped to one session's Space by the store it is bound to.
  *
+ * The blob is stamped with the `controller` DID whose descriptors it holds, and
+ * a cache bound to a different controller reads it as empty (and overwrites the
+ * stamp on its first write). Descriptors name key-epoch rosters a specific
+ * identity is a recipient of, so a login under a different controller than the
+ * one that cached them must never trust them: a stale hit would build ciphers
+ * the new identity cannot unwrap.
+ *
  * The blob is read-modify-written on every put. That is fine at this scale (an
  * app registers a handful of collections) and it is the only shape the existing
  * one-record persistence allows; concurrent puts are serialized through a
@@ -60,9 +68,12 @@ export declare function createSeedStore({ dbName, idb }: {
  *
  * @param options {object}
  * @param options.store {SeedStore}   the session seed store to persist through
+ * @param options.controller {string}   the controller DID the cached
+ *   descriptors belong to
  * @returns {EncryptionDescriptorCache}
  */
-export declare function createDescriptorCache({ store }: {
+export declare function createDescriptorCache({ store, controller }: {
     store: SeedStore;
+    controller: string;
 }): EncryptionDescriptorCache;
 //# sourceMappingURL=seedStore.d.ts.map

package/dist/identity/seedStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seedStore.d.ts","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAOjF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrC;;;;OAIG;IACH,eAAe,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,GAAe,EAChB,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,UAAU,CAAA;CACjB,GAAG,SAAS,CAyEZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,yBAAyB,CAmC5B"}
+{"version":3,"file":"seedStore.d.ts","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAOjF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,eAAe,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,GAAe,EAChB,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,UAAU,CAAA;CACjB,GAAG,SAAS,CAyEZ;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,KAAK,EACL,UAAU,EACX,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GAAG,yBAAyB,CA2C5B"}

package/dist/identity/seedStore.js

@@ -73,6 +73,13 @@ export function createSeedStore({ dbName, idb = indexedDB }) {
  * acquires through: per-collection get/put over the single stored blob, already
  * scoped to one session's Space by the store it is bound to.
  *
+ * The blob is stamped with the `controller` DID whose descriptors it holds, and
+ * a cache bound to a different controller reads it as empty (and overwrites the
+ * stamp on its first write). Descriptors name key-epoch rosters a specific
+ * identity is a recipient of, so a login under a different controller than the
+ * one that cached them must never trust them: a stale hit would build ciphers
+ * the new identity cannot unwrap.
+ *
  * The blob is read-modify-written on every put. That is fine at this scale (an
  * app registers a handful of collections) and it is the only shape the existing
  * one-record persistence allows; concurrent puts are serialized through a
@@ -80,13 +87,18 @@ export function createSeedStore({ dbName, idb = indexedDB }) {
  *
  * @param options {object}
  * @param options.store {SeedStore}   the session seed store to persist through
+ * @param options.controller {string}   the controller DID the cached
+ *   descriptors belong to
  * @returns {EncryptionDescriptorCache}
  */
-export function createDescriptorCache({ store }) {
+export function createDescriptorCache({ store, controller }) {
     async function readAll() {
-        const stored = await store.loadDescriptors();
-        if (stored && typeof stored === 'object' && !Array.isArray(stored)) {
-            return { ...stored };
+        const stored = (await store.loadDescriptors());
+        if (stored?.controller === controller &&
+            stored.descriptors &&
+            typeof stored.descriptors === 'object' &&
+            !Array.isArray(stored.descriptors)) {
+            return { ...stored.descriptors };
         }
         return {};
     }
@@ -100,7 +112,7 @@ export function createDescriptorCache({ store }) {
             const next = writes.then(async () => {
                 const descriptors = await readAll();
                 descriptors[collectionId] = descriptor;
-                await store.saveDescriptors(descriptors);
+                await store.saveDescriptors({ controller, descriptors });
             });
             writes = next.then(() => { }, () => { });
             return next;